TrueKin is run by Nexlr Private Limited (“TrueKin”, “we”, “us”), a company registered in India. For the personal data described here, we are the data controller (the “data fiduciary” under India’s DPDP Act).
General questions: support@truekin.app. Privacy questions and requests: privacy@truekin.app.
Complaints and grievances: grievance@truekin.app. We acknowledge complaints within 24 hours and aim to resolve them within 15 days.
Account details: your name, email, password (stored only as a secure hash), date of birth (to confirm you’re 18 or over), and your phone number if you add one. If you sign in with Google, Apple or Facebook, we receive your name and email from them.
What you keep: memories (text, photos, voice, video, drawings), the people you add (such as your child’s name and birthday, and family members’ names, relationships and email addresses), your milestones, and the delivery dates you choose.
Protecting your family: the guardians you choose (name, email, phone), check-in replies, and For My Family information you choose to add, such as notes about accounts, insurance or property.
Passing reports: if someone reports a passing, the report and the death certificate they upload.
Billing: your plan and payment status. Dodo Payments holds your card details; we never see them.
Technical data: sign-in times, IP address, device and browser type, and error logs, used to keep TrueKin secure and working.
Messages you send us, and your email if you join our waiting list.
To provide TrueKin to you under our terms: keep and deliver your memories, run your account and plan, send the emails and texts the service needs. (Legal basis in the EU/UK: performance of a contract.)
To keep TrueKin secure, prevent fraud and false passing reports, and fix problems. (Legitimate interests.)
Faith features, weekly questions and other optional emails, only if you switch them on. (Consent, which you can withdraw at any time in Settings.)
To meet legal duties, such as tax records and answering lawful requests. (Legal obligation.)
We don’t use your memories to train AI, for advertising, or to build a profile of you. We don’t sell or rent personal data, and we don’t “share” it for cross-context behavioural advertising.
Faith: if you switch on faith features, we keep your faith tradition and any prayers you write. This can reveal your religious beliefs, so we only do it with your explicit consent, given when you switch it on. Switch it off in Settings, Faith, to withdraw consent and stop its use.
Children: information about children is added by their parent or family. We use it only to keep and deliver what the family keeps for them.
Death certificates are seen only by our review team, only to check a report, and are deleted 90 days after the review ends.
For My Family information is encrypted like your memories and is never shared while you are alive.
With the people you choose: recipients, guardians and family members you invite see what you send or share with them.
With providers who run TrueKin for us, under contracts that limit them to that job: Google Cloud (hosting, storage, encryption keys, sign-in with Google), Resend (email), Twilio and MSG91 (text messages), Dodo Payments (payments and tax), Zoho (our support mailbox), Cloudflare (domain and network security), and Apple and Meta if you sign in with them.
When the law requires it, to protect someone’s safety, or as part of a sale or merger of TrueKin, in which case this policy continues to apply to your data.
Your data is stored with Google Cloud in the United States (us-central1). Our team works from India, and some providers process data in other countries.
When data from the EU, UK or other countries with transfer rules leaves those regions, we protect it with the European Commission’s Standard Contractual Clauses and the UK’s international data transfer addendum, or another lawful safeguard. Ask us for a copy.
We keep your data while your account is open. When you delete your account, we wait 30 days, then delete what you kept (except memories already delivered and any you chose to still deliver). Backups are overwritten within a further 30 days.
Death certificates: 90 days after the review ends. Security logs: up to one year, longer where Indian law requires. Billing records: as long as tax law requires (Dodo Payments keeps its own records). Waiting-list emails: until you unsubscribe or we launch to you.
Memory content, attachments and For My Family information are encrypted at rest with AES-256-GCM using a key unique to your account, which is itself protected by Google Cloud Key Management Service. Data is encrypted in transit with TLS.
Because our servers hold the keys, TrueKin can technically decrypt your content; it is decrypted only to show it to you or deliver it. Our team doesn’t browse memories and accesses content only at your request, to check a passing report, or where the law requires. Keys and decrypted content are never written to logs.
If a breach puts your data at risk, we will tell you and the relevant authorities as the law requires.
You can see, correct, export or delete your data at any time from Settings, or by writing to privacy@truekin.app. We reply within 30 days.
In the EU and UK you also have the right to restrict or object to our use of your data, to data portability, and to withdraw consent at any time. You can complain to your local data protection authority (in the UK, the ICO).
In India you have the rights given by the Digital Personal Data Protection Act, including nominating someone to exercise your rights if you die or can’t, and may complain to the Data Protection Board of India after contacting our Grievance Officer.
In Canada, Australia and US states with privacy laws (such as California), you have similar rights to access, correct and delete your data, and to not be discriminated against for using them. You can contact the Office of the Privacy Commissioner of Canada, or the Office of the Australian Information Commissioner.
Account holders must be 18 or over. We don’t knowingly let children create accounts.
A child receives memories by email and doesn’t need an account. When a child opens a delivery, we collect only what is needed to show it and record that it was opened. We never market to children.
If you believe a child has given us personal data without a parent’s permission, write to privacy@truekin.app and we will delete it.
Service messages (sign-in codes, deliveries, guardian and check-in messages, billing and renewal notices) are part of running your account.
Optional emails, like the weekly question and reminders, are sent only if you switch them on, and every one has an unsubscribe link. We send texts only for important things, like sign-in codes and guardian messages, to numbers you have verified. Reply STOP to stop non-essential texts.
If we change this policy in a way that matters, we’ll email you before the change takes effect. The date at the top shows when it last changed.